# _harvestCore() roi calculation error

_harvestCore double-counts strategy losses by subtracting loss from roi after already computing roi from totalAssets vs allocated, corrupting vault loss reporting and debt accounting.

- Payout: Contest reward
- Severity: medium
- Program: Ethos Reserve
- Credited: bin2chen
- Disclosed: 2023-05-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-02-ethos-findings/issues/752
- Library page: https://bugbountylibrary.com/r/c4%3A2023-02-ethos%3AM-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error

**Target:** Vault/Strategy harvest accounting (Solidity)
**Root cause:** roi is derived from totalAssets vs allocated (which already reflects the loss), then `roi -= int256(loss)` subtracts the same loss again, double-counting it.
**Steps:**
1. Deploy vault+strategy, deposit 10, harvest so allocated=9, totalAssets=9
2. Simulate loss of 2 via `lossFortest(toWantUnit('2'))` so totalAssets=7
3. Set allocBPS=0 via `updateStrategyAllocBPS(strategy, 0)` so debt=9
4. Call `strategy.harvest()`
5. Observe vault.strategies losses=4 instead of 2 (roi=4, repayment=7)
**How found:** Code reading of _harvestCore: noticed roi already computed from totalAssets vs allocated, then loss subtracted again at the end, and constructed a scenario where allocBPS=0 forces full debt liquidation to expose the double count.
**Insight:** When a function computes PnL from a balance delta and also subtracts a separately-returned loss value, check whether the loss is already embedded in the balance delta — double-counting corrupts downstream debt/report accounting.